CVE-2026-129482 in OkHttp
Summary
by MITRE • 11/15/2026
OkHttp through 5.5.1 contains an improper certificate validation vulnerability in CertificatePinner that skips pin checks because Pin.matchesHostname does not normalize trailing-dot hostnames. Network attackers with a CA-trusted certificate not matching configured pins can intercept or modify TLS traffic when applications request the trailing-dot form of pinned hosts.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/15/2026
The OkHttp library, specifically through version 5.5.1, contains a critical security flaw within its CertificatePinner component that undermines the integrity of Transport Layer Security connections by failing to properly validate hostname pinning configurations. This vulnerability stems from an implementation error in the Pin.matchesHostname method, which is responsible for verifying whether a server's certificate matches the pinned public keys associated with specific hosts. The core technical deficiency lies in the handling of trailing-dot hostnames, also known as fully qualified domain names or FQDNs that end with a dot character to denote the root zone. When an application requests a resource using this trailing-dot format, such as example.com., the validation logic fails to normalize this input against standard hostname representations before performing pin checks. Consequently, the comparison between the certificate's subject alternative name and the configured pins does not account for the equivalence of these two forms, leading to a bypass of the intended security controls.
This improper normalization allows network attackers who possess a valid certificate trusted by the system's Certificate Authority chain but which is not pinned in the application configuration to successfully intercept or modify TLS traffic targeting hosts accessed via their trailing-dot variants. In standard DNS and TLS operations, example.com and example.com. are functionally identical; however, because OkHttp treats them as distinct entities due to the missing normalization step, an attacker can present a legitimate CA-signed certificate for example.com that is not included in the application's pin set. Since the library does not recognize this match against the pinned entry for example.com., it accepts the connection without raising a security exception. This effectively nullifies the protection offered by Certificate Pinning, which is designed to prevent man-in-the-middle attacks even if an attacker obtains a fraudulent or misissued certificate from a compromised CA.
The operational impact of this vulnerability is significant for applications relying on OkHttp for secure communications, particularly those that may inadvertently construct URLs with trailing dots due to user input processing, legacy system integrations, or specific DNS resolution behaviors. By bypassing pin validation, the application loses its ability to detect unauthorized intermediaries in the communication path. This exposes sensitive data transmitted over these connections to eavesdropping and tampering, violating confidentiality and integrity requirements. The flaw represents a classic case of trust boundary confusion where the software fails to canonicalize inputs before security checks, allowing an attacker to exploit the discrepancy between logical identity and string representation.
From a classification perspective, this vulnerability aligns with CWE-295 Improper Certificate Validation, as it involves failing to properly validate X.509 certificates against expected trust anchors or pinned keys. It also maps to MITRE ATT&CK technique T1078 Valid Accounts when considering the use of legitimate CA-signed certificates by attackers, and more broadly falls under lateral movement or interception techniques that exploit weaknesses in cryptographic implementation rather than protocol flaws themselves. The root cause is a logic error in hostname comparison algorithms where canonicalization steps are omitted prior to security assertions.
To mitigate this risk, developers using OkHttp should immediately upgrade to version 5.6.0 or later, where the CertificatePinner has been patched to correctly normalize trailing-dot hostnames before performing pin comparisons. This ensures that both example.com and example.com. resolve to the same set of pinned public keys, thereby closing the bypass vector. In environments where upgrading is not immediately feasible, applications should implement strict input sanitization to ensure all HTTP requests are constructed with canonical domain names lacking trailing dots. Additionally, organizations should review their certificate pinning strategies to include multiple variants if necessary, although relying on library fixes remains the most robust defense against this specific implementation flaw. Regular security audits and static code analysis tools configured to detect improper hostname normalization can help identify similar issues in custom networking logic before deployment.